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Fig. 2 
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Fig. 4 



+1.0 



Expertise 



Q 

m 

M 

ru 
* 

» 

p 

IP 
a 
en 
q 



-1.0 



Deception 



+ 1.0 



-1 .0 



Jun-06-01 11:10am From-H*fi H 3-\?ast *2 



+ 



T-344 P. 038/038 F-374 



Receive 
incoming traffic 
S510 



Fig. 5 



Sort traffic 
S520 




Session 
Database 
Storage 
S597 









process within 




the activity 




monitor 









S560 



No 



Assessment 
S540 





Yes 








Store tracking 




information 




S570 




Block activity 
and store 
relevant 
assessment 
and identifying 
information 
S590 



No 



Continue 
session 
monitoring 
S595 



